Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Code Block
bgColor#FFcccc
langc
/* sock is a connected TCP socket */

uint32_t num;

if (recv(sock, (void *)&num, sizeof(uint32_t), 0) < 0(int)sizeof(uint32_t)) {
  /* Handle error */
}

printf("We received %u from the network!\n", (unsigned int)num);

This program prints out the number received from the socket using an incorrect byte ordering. For example, if the value 4 is sent from a big endian machine, and the receiving system is little endian, the value 536,870,912 is read. This problem can be corrected by sending and receiving using network byte ordering.

Compliant

...

Solution

In this compliant code examplesolution, the programmer uses the ntohl() function to convert the integer from network byte order to host byte ordering:

Code Block
bgColor#ccccff
langc
/* sock is a connected TCP socket */

uint32_t num;

if (recv(sock, (void *)&num, sizeof(uint32_t), 0) < 0(int)sizeof(uint32_t)) {
  /* Handle error */
}

num = ntohl(num);
printf("We recieved %u from the network!\n", (unsigned int)num);

...

If the programmer is careless, this bug is likely. However, it will immediately break the program by printing the incorrect result and therefore should be caught by the programmer during the early stages of debugging and testing. Recognizing a value as in reversed byte ordering, however, can be difficult depending on the type and magnitude of the data.

Recommendation

Severity

Likelihood

Remediation Cost

Detectable

Repairable

Priority

Level

POS39-C

Medium

medium

Likely

likely

Yes

low

No

P18

L1

 

P12

L1

Automated Detection

Tool

Version

Checker

Description

Astrée
Include Page
Astrée_V
Astrée_V

taint_sink

Soundly supported
Axivion Bauhaus Suite

Include Page
Axivion Bauhaus Suite_V
Axivion Bauhaus Suite_V

CertC-POS39
Helix QAC

Include Page
Helix QAC_V
Helix QAC_V

DF4906, DF4907, DF4908
Klocwork
Include Page
Klocwork_V
Klocwork_V
BYTEORDER.NTOH.RECV
BYTEORDER.NTOH.READ
BYTEORDER.HTON.SEND
BYTEORDER.HTON.WRITE

Parasoft C/C++test

Include Page
Parasoft_V
Parasoft_V

CERT_C-POS39-a

Use the correct byte ordering when transferring data between systems

Polyspace Bug Finder

Include Page
Polyspace Bug Finder_V
Polyspace Bug Finder_V

CERT C: Rule POS39-CChecks for missing byte reordering when transferring data (rule fully covered)

Bibliography

...


...

Image Modified Image Modified Image Modified